<?php
// Verification of authorized active effects by a repeatable READ ONLY transaction. No providers.
use Illuminate\Foundation\Bootstrap\LoadConfiguration;
use Illuminate\Foundation\Bootstrap\LoadEnvironmentVariables;
use Illuminate\Encryption\Encrypter;
use App\Services\OrganizationCountryInstallation;
$root=dirname(__DIR__); require $root.'/vendor/autoload.php'; ini_set('zend.exception_ignore_args','1');
set_exception_handler(static function(Throwable $e):void { fwrite(STDERR,'Active verification stopped: '.$e->getMessage().PHP_EOL);exit(1); });
$app=require $root.'/bootstrap/app.php';(new LoadEnvironmentVariables)->bootstrap($app);(new LoadConfiguration)->bootstrap($app);
$dir=$root.'/storage/app/private/investmoz-v2/portal-audit';
$read=static fn($p)=>json_decode(file_get_contents($p),true,512,JSON_THROW_ON_ERROR);
$before=$read($dir.'/country-https-active-preflight-20261011.json');
$proof=$read($before['readiness_proof_path']);
$mode=$argv[1] ?? 'before-apply';throw_unless(in_array($mode,['before-apply','installed-disabled','enabled','reverted'],true),RuntimeException::class,'Unknown phase.');
$expectedFingerprint=$mode==='reverted'?$before['source_code_hash']:$before['code_hash'];
throw_unless((new OrganizationCountryInstallation)->fingerprint()===$expectedFingerprint,RuntimeException::class,'Active code differs from expected phase.');
$c=config('database.connections.'.config('database.default'));
throw_unless($c['driver']==='pgsql' && empty($c['url']) && (int)$c['port']===5432 && $c['database']==='investemoz',RuntimeException::class,'Exact target required.');
$key=config('app.key');$zip=new ZipArchive;throw_unless($zip->open($proof['files_path'])===true,RuntimeException::class,'Backup unavailable.');
$runtime=json_decode($zip->getFromName('runtime/effective-runtime.json'),true,512,JSON_THROW_ON_ERROR);$zip->close();
throw_unless($runtime['app_key']===$key && $runtime['cipher']===config('app.cipher'),RuntimeException::class,'Encryption key/cipher changed.');
$key=str_starts_with($key,'base64:')?base64_decode(substr($key,7),true):$key;$crypt=new Encrypter($key,config('app.cipher'));
if($mode!=='reverted') {
    throw_unless(config('app.url')==='https://portal-investidor.test' && config('session.cookie')==='portal_investidor_https'
        && config('session.secure')===true && config('session.domain')===null && config('session.path')==='/' && config('session.same_site')==='lax',RuntimeException::class,'Effective HTTPS/session config differs.');
} else {
    $stage=$read($dir.'/country-https-active-stage-latest.json');
    foreach($stage['backup_files'] as $file=>$entry){throw_unless(hash_file('sha256',$file)===$entry['sha256'],RuntimeException::class,'Reversed file differs from snapshot.');}
}
$flags=[];foreach(['opportunity_dashboard_access_enabled','profile_access_enabled','opportunity_specialized_drafts_enabled','opportunity_modular_profiles_qa_enabled','legacy_content_qa_enabled'] as $flag){$flags[$flag]=(bool)config('portal.'.$flag);throw_if($flags[$flag],RuntimeException::class,'Unapproved flag enabled.');}
$flags['investor_path_enabled']=(bool)config('investor-path.enabled');throw_if($flags['investor_path_enabled'],RuntimeException::class,'Unapproved investor path flag enabled.');
$enabled=(bool)config('portal.organization_country_enabled');throw_unless($enabled===($mode==='enabled'),RuntimeException::class,'Country flag differs from phase.');
$pdo=new PDO('pgsql:host='.$c['host'].';port=5432;dbname=investemoz',$c['username'],$c['password'],[PDO::ATTR_ERRMODE=>PDO::ERRMODE_EXCEPTION]);
$pdo->exec('BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY');
throw_unless($pdo->query('SELECT current_database()')->fetchColumn()==='investemoz' && (int)$pdo->query('SELECT inet_server_port()')->fetchColumn()===5432,RuntimeException::class,'Server identity differs.');
$tables=[];$changed=[];
foreach($pdo->query("SELECT schemaname,tablename FROM pg_tables WHERE schemaname NOT IN ('pg_catalog','information_schema') ORDER BY schemaname,tablename")->fetchAll(PDO::FETCH_ASSOC) as $t){
    $name='"'.str_replace('"','""',$t['schemaname']).'"."'.str_replace('"','""',$t['tablename']).'"';
    $rows=$pdo->query('SELECT row_to_json(t)::text FROM '.$name.' t ORDER BY row_to_json(t)::text')->fetchAll(PDO::FETCH_COLUMN);
    $tables[$name]=['count'=>count($rows),'sha256'=>hash('sha256',implode("\n",$rows))];if(($before['tables'][$name]??null)!==$tables[$name])$changed[]=$name;
}
throw_unless(array_keys($tables)===array_keys($before['tables']),RuntimeException::class,'A table was created/removed.');
$allowed=['"public"."sessions"','"public"."cache"','"public"."cache_locks"'];
if(!in_array($mode,['before-apply','reverted'],true))$allowed=[...$allowed,'"public"."migrations"','"public"."audit_events"'];
throw_unless(array_diff($changed,$allowed)===[],RuntimeException::class,'Business rows changed outside reviewed effects.');
$counts=[];foreach(array_keys($before['counts']) as $table)$counts[$table]=(int)$pdo->query('SELECT count(*) FROM "'.$table.'"')->fetchColumn();
foreach(['users','organizations','memberships'] as $table)throw_unless($counts[$table]===$before['counts'][$table],RuntimeException::class,'An identity/organization/membership was created or removed.');
$migrations=$pdo->query("SELECT migration FROM migrations WHERE migration IN ('2026_10_09_030000_extend_opportunity_resources','2026_10_10_040000_create_portal_profile_authorization','2026_10_09_190000_prepare_investor_path','2026_10_10_050000_extend_organization_country') ORDER BY migration")->fetchAll(PDO::FETCH_COLUMN);
$columns=$pdo->query("SELECT column_name,data_type,is_nullable,character_maximum_length FROM information_schema.columns WHERE table_schema='public' AND table_name='organizations' AND column_name IN ('incorporation_country_code','incorporation_country_provenance') ORDER BY column_name")->fetchAll(PDO::FETCH_ASSOC);
$audits=$pdo->query("SELECT actor_user_id,correlation_id,after_data FROM audit_events WHERE source_system='organization-country-installation' ORDER BY created_at,id")->fetchAll(PDO::FETCH_ASSOC);
if(in_array($mode,['before-apply','reverted'],true)){throw_unless($migrations===[] && $columns===[] && $audits===[],RuntimeException::class,'Unexpected installation before authenticated action.');}
else {
    throw_unless($migrations===[OrganizationCountryInstallation::MIGRATION] && count($columns)===2 && count($audits)===1,RuntimeException::class,'Installation effects differ.');
    throw_unless($counts['migrations']===$before['counts']['migrations']+1 && $counts['audit_events']===$before['counts']['audit_events']+1,RuntimeException::class,'Ledger/audit count differs.');
    $receipt=json_decode($audits[0]['after_data'],true,512,JSON_THROW_ON_ERROR);throw_unless($receipt['code_hash']===$before['code_hash'] && $receipt['result']['new_columns']===2 && $receipt['result']['new_tables']===0 && $receipt['result']['new_organizations']===0,RuntimeException::class,'Audited receipt differs.');
}
$recovered=0;foreach($pdo->query('SELECT two_factor_secret FROM users WHERE two_factor_secret IS NOT NULL')->fetchAll(PDO::FETCH_COLUMN) as $encrypted){$v=$crypt->decrypt($encrypted);throw_unless(is_string($v)&&strlen($v)>0,RuntimeException::class,'Original MFA unreadable.');unset($v);$recovered++;}
$pdo->exec('ROLLBACK');
$result=['result'=>'passed','at'=>gmdate('c'),'phase'=>$mode,'code_hash'=>$expectedFingerprint,'prepared_code_hash'=>$before['code_hash'],'delivery_revision'=>$before['delivery_revision'],
    'origin'=>config('app.url'),'country_enabled'=>$enabled,'other_flags'=>$flags,'tables'=>count($tables),'counts_before'=>$before['counts'],'counts_after'=>$counts,
    'changed_tables'=>$changed,'business_rows_preserved'=>true,'columns'=>$columns,'installed_packages'=>$migrations,'installation_audits'=>count($audits),
    'original_mfa_envelopes_recovered'=>$recovered,'key_and_cipher_preserved'=>true,'active_SQL_writes_by_verifier'=>0,
    'actual_master_save_available'=>$counts['organizations']>0 && $counts['memberships']>0,
    'master_save_limitation'=>$counts['organizations']===0?'No real organization or membership; active master write/reuse cannot be demonstrated without separately authorized legitimate master data.':null];
file_put_contents($dir.'/country-https-active-check-'.$mode.'-20261011.json',json_encode($result,JSON_PRETTY_PRINT|JSON_THROW_ON_ERROR));echo json_encode($result,JSON_THROW_ON_ERROR).PHP_EOL;